fix(security): remove shell: true from execa calls to prevent command injection

[riaworks]

Summary

• sandbox-tester.js: Remove redundant shell: true from execa() in runCommand() — args were already split into array, making shell interpretation unnecessary and a security risk
• subtask-verifier.js: Remove shell: true from execa() path and replace execSync fallback with execFileSync + proper argument splitting

Context

Both scripts already split command strings into program + args array before passing to execa(), making shell: true completely redundant. With shell: true, shell metacharacters (;, |, &&, $()) in command inputs would be interpreted, enabling potential command injection.

Risk Assessment

• sandbox-tester.js was flagged as the most dangerous file in the codebase due to shell: true + arbitrary command execution
• subtask-verifier.js combines shell execution + network access + browser automation — broad attack surface

Changes

File	Change
sandbox-tester.js:454	Removed shell: true from execa() options
subtask-verifier.js:277	Replaced execSync with execFileSync + arg splitting
subtask-verifier.js:304	Removed shell: true from execa() options

Test plan

• npm test passes
• Sandbox tester runs npm test and npm run lint commands correctly without shell: true
• Subtask verifier command verification works with execFileSync fallback

🤖 Generated with Claude Code

[vercel]

@riaworks is attempting to deploy a commit to the Pedro Valério Lopez's projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Note

Reviews paused

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• main

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

Tip

Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[riaworks]

CodeRabbit review is running on the fork PR: riaworks#2
Review results will be validated there before requesting merge here.

@coderabbitai ignore

[coderabbitai]

@riaworks: Understood! I'll pause reviews on this PR while you validate the changes on the fork PR. Feel free to ask me to resume when you're ready to merge.

✅ Actions performed

Reviews paused.